buytrx[.]com[.]co

PhishDestroy identifies buytrx.com.co as an active phishing domain posing as a cryptocurrency exchange under the 'BuyTRX' branding. This fraudulent site mimics legitimate trading platforms to deceive users into depositing funds or exposing wallet credentials. The domain specifically targets individuals seeking to purchase TRX tokens, redirecting victims to a spoofed interface that steals deposited funds or harvests private keys. Security teams should treat this as a high-risk credential theft and financial fraud campaign given its active status and lack of detection coverage. This domain was flagged by PhishDestroy with zero detections out of 95 VirusTotal scans, indicating it has evaded current detection signatures. The infrastructure is hosted on IP 188.114.97.3 and secured with a Let's Encrypt SSL certificate to appear legitimate. The domain was registered through TLD Registrar Solutions Ltd. on March 21, 2026—extremely recently—suggesting a hastily deployed campaign. These attributes, combined with the absence of blocklist coverage, elevate the threat level and necessitate immediate preventative measures. Users who visited buytrx.com.co should assume their credentials or cryptocurrency may have been compromised. Disconnect from the internet, revoke any exposed API keys or wallet approvals, and transfer remaining funds to a new wallet with updated security settings. Report the incident to your exchange and cryptocurrency platform support teams with the domain and timestamp. Consider running a full malware scan and rotating all related passwords and 2FA tokens across financial accounts. Monitor blockchain transactions for unauthorized transfers and report suspicious activity to local cybercrime units.